From 49e83256b4f3ebe05c9e9fab5a55c6d502faf491 Mon Sep 17 00:00:00 2001 From: Petr Viktorin Date: Wed, 4 Jun 2014 17:39:10 +0200 Subject: Convert Password Policy default permissions to managed Part of the work for: https://fedorahosted.org/freeipa/ticket/4346 Reviewed-By: Martin Kosek --- install/updates/40-delegation.update | 26 -------------------------- 1 file changed, 26 deletions(-) (limited to 'install/updates/40-delegation.update') diff --git a/install/updates/40-delegation.update b/install/updates/40-delegation.update index 690f02eeb..889f3a1f6 100644 --- a/install/updates/40-delegation.update +++ b/install/updates/40-delegation.update @@ -170,32 +170,6 @@ default:objectClass: top default:cn: Password Policy Administrator default:description: Password Policy Administrator -dn: cn=Add Group Password Policy,cn=permissions,cn=pbac,$SUFFIX -default:objectClass: groupofnames -default:objectClass: ipapermission -default:objectClass: top -default:cn: Add Group Password Policy -default:member: cn=Password Policy Administrator,cn=privileges,cn=pbac,$SUFFIX - -dn: cn=Delete Group Password Policy,cn=permissions,cn=pbac,$SUFFIX -default:objectClass: groupofnames -default:objectClass: ipapermission -default:objectClass: top -default:cn: Delete Group Password Policy -default:member: cn=Password Policy Administrator,cn=privileges,cn=pbac,$SUFFIX - -dn: cn=Modify Group Password Policy,cn=permissions,cn=pbac,$SUFFIX -default:objectClass: groupofnames -default:objectClass: ipapermission -default:objectClass: top -default:cn: Modify Group Password Policy -default:member: cn=Password Policy Administrator,cn=privileges,cn=pbac,$SUFFIX - -dn: $SUFFIX -add:aci: '(target = "ldap:///cn=*,cn=$REALM,cn=kerberos,$SUFFIX")(version 3.0;acl "permission:Add Group Password Policy";allow (add) groupdn = "ldap:///cn=Add Group Password Policy,cn=permissions,cn=pbac,$SUFFIX";)' -add:aci: '(target = "ldap:///cn=*,cn=$REALM,cn=kerberos,$SUFFIX")(version 3.0;acl "permission:Delete Group Password Policy";allow (delete) groupdn = "ldap:///cn=Delete Group Password Policy,cn=permissions,cn=pbac,$SUFFIX";)' -add:aci: '(targetattr = "krbmaxpwdlife || krbminpwdlife || krbpwdhistorylength || krbpwdmindiffchars || krbpwdminlength || krbpwdmaxfailure || krbpwdfailurecountinterval || krbpwdlockoutduration")(target = "ldap:///cn=*,cn=$REALM,cn=kerberos,$SUFFIX")(version 3.0;acl "permission:Modify Group Password Policy";allow (write) groupdn = "ldap:///cn=Modify Group Password Policy,cn=permissions,cn=pbac,$SUFFIX";)' - # Allow an admin to enroll a host that has a one-time password. # When a host is created with a password no krbPrincipalName is set. # This will let it be added if the client ends up enrolling with -- cgit